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For the complete estimation of arbitrary unknown quantum states by measurements, the use 
of mutually unbiased bases has been well-established in theory and experiment for the past 20 
years. However, most constructions of these bases make heavy use of abstract algebra and the 
mathematical theory of finite rings and fields, and no simple and generally accessible construction 
is available. This is particularly true in the case of a system composed of several qubits, which is 
arguably the most important case in quantum information science and quantum computation. In 
this letter, we close this gap by providing a simple and straightforward method for the construction 
of mutually unbiased bases in the case of a qubit register. We show that our construction is also 
accessible to experiments, since only Hadamard and controlled phase gates are needed, which are 
available in most practical realizations of a quantum computer. Moreover, our scheme possesses the 
optimal scaling possible, i. e., the number of gates scales only linearly in the number of qubits. 



In quantum physics, the estimation of the state of a 
system is of high practical value [l[. It is well-known 
that for the complete estimation of a state, known as 
state tomography, a single measurement is not sufficient, 
even if performed many times to get the statistics of such 
measurement. It is necessary to measure a state in var- 
ious different bases. The best choice of such bases for 
an arbitrary system is so-called mutually unbiased bases 
(MUBs), which offer the highest information outcome, 
as already stated by Wootters and Fields mutually 
unbiased bases provide an optimal means of determining 
an ensemble's state. Experimental results demonstrate 
the practicability of those schemes Different con- 

struction methods for MUBs are known [2|, lil-fiot . For a 
d-level system, i. e., a system described by a d x d density 
matrix, one would need d -\- 1 mutually unbiased bases, 
since any measurement statistically reveals d — 1 param- 
eters. Unfortunately, it is not even known whether d-\-l 
such bases exist in every c?-lcvel system. Mutually unbi- 
ased bases are related to different topics in mathematics 
and physics, e. g., quantum cryptography, foundations of 



physics 
models 




orthogonal Latin squares or hidden- variable 
13 1 and even Feynman's path integral [l^ . 



In this letter, we want to focus on a system which is 
of particular interest in quantum information processing, 
namely, a quantum register built of qubits. We propose 
a complete set of mutually unbiased bases for quantum 
registers of size 1, 2, 4, 8, . . . , 256. In general, the con- 
struction of MUBs is quite involved and uses methods 
from abstract algebra and the mathematical theory of fi- 
nite fields and rings [l^, which are far apart from most 
methods that are commonly used in physics. We over- 
come this problem in such a way, that our construction 
(although not its proof) is very easy to follow and to ap- 
ply by anyone with just basic knowledge of linear algebra. 
Moreover, our construction is applicable to experiments 
with only limited effort. In particular, the experimen- 
tator must only be able to perform, on a system of m 



qubits, a single unitary operation Um, by which all the 
d-|-l MUBs are generated. (Obviously, he must be able to 
perform measurements in at least one basis, say, the stan- 
dard basis.) This single unitary operator is of the partic- 
ular form [/„ = e''^"2-™/2i7®"P„, where 2-™/277®" 
denotes the m-fold tensor product of Hadamard matri- 
ces, Pm is a diagonal phase matrix and e"'^ a global phase. 
The columns of C/, [Z^, f/^, . . . , [/2'"+i = l^^ then de- 
fine mutually unbiased bases. Any phase matrix Pm can 
be decomposed into CPhase gates and together with the 
one-qubit Hadamard gate, belongs to the building blocks 
of one of the several universal sets of gates for a quantum 
computer. As any reasonable quantum computer will be 
able to perform such operations [iBj . no extra effort is 
needed to implement our measurement; an example cir- 
cuit is given in the figure. 

We shall now present our construction in detail. For 
a single qubit we have the Hadamard transformation 
2-1/2// -v^rith H = [I _\), which switches between the 
mutually unbiased z- and the x-bases. (It is convenient to 
choose the matrix H to be non-normalized, so that it and 
its tensor products contain only ±1.) Multiplying this by 
a phase Pi = diag(l, -i), we find that T := 2-'^/'^H ■ Pi 
cyclically switches between the mutually unbiased z-, x- 
and the y-bases (up to a global phase). This matrix is 
well-known e.g., in quantum key distribution where it is 
used in the six-state protocol (cf. e.g. [3, 12|)- We 
want to generalize this construction to higher numbers 
of qubits. If we take a number m of qubits, it is obvious 
that the m-fold tensor product i/®™ switches between 
two mutually unbiased bases, composed of local z- and 
x-bases. We can switch between 2"' + 1 mutually unbi- 
ased bases, if we apply a diagonal phase gate (such as Pi 
above). Determining these local phases, which turn out 
to be either ±1 or ±i is non-trivial, not even numerically, 
but can be achieved by our method. Given the unitary 
T as above, we can construct a two-qubit phase matrix 
by reading it out row-wise, i.e. P2 = diag(l, — i, l,i). It 
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FIG. 1. Quantum circuit for the generator U4 for a four-qubit 
register. 



turns out that U2 = i2~^H^^P2 produces a cycle of five 
MUBs. We can iterate this procedure to get MUBs for 
4,8, etc. qubits. Although these choices of P4, Ps, etc. 
appear to be accidental for now, this structure has deep 
mathematical roots, which we will elaborate on later in 
this letter. In particular, this construction is related to 
Wiedemann's conjecture 18| from finite-field theory, and 
is, as such, only valid for up to 256 qubits. However, it 
may hold for even higher numbers such as 512, 1024 etc. 
If this is true for all powers of two, this would prove 
Wiedemann's conjecture. 

To implement these unitaries in experiments we will 
now give decomposition of the phase system Pm into ele- 
mentary gates. To do so, we will have to touch the math- 
ematical roots of this matrix structure. But let us start 
with two elementary gates, the one-qubit Phase gate and 
the two-qubit controUed-phase or CPhase gate: 



Phase,(e"^) = |0),(0|+e''^|l),(l|, (1) 
CPhase,^t(e''^) = |0),(0| |0)t(0| + |0),,(0| ® |l)t(l| 

+ |1),(1|® |0)t(OKe''^|l),(l|® |l)t(l|. (2) 

The prototype of a phase gate is Pauli's (Tz with e"^ = — 1, 
but in our case we usually have e"^ — ±i. Note that in 
the case of a CPhase gate, source and target qubits are 
interchangeable and moreover, all these gates commute, 
since they are diagonal. 

The recursive procedure we use to construct from 
Pm results from a similar procedure for an to x to matrix 



(bki) 



k,l=l 



with entries and 1 and arithmetics 



modulo 2 (more formally, over the finite field F2), which 
describes the phase system. This matrix has to fulfill 
several properties [l^, related to a stabilizer structure 
(that is, why we call it the reduced stabilizer matrix), 
e. g. it must be symmetric. However, in our case it is 
more advisable to view it as the adjacency matrix of an 
undirected graph with m qubits (as vertices) and edges 
between qubits i and j, if bij = 1. We allow loops, i.e. 
bii = 1 is possible, but they need to be treated separately. 

We shall label the basis vectors of an m-qubit system 
by bit strings of length to, namely by j*= (ji, . . . , jmY, 
where ji G {0, 1} for all i £ {1,...,to}. The relation 
between Bm and the phase system P,„ = diag[(pj-)j*gF™] 
was derived before [3, ^^'^ can be written as 



= l bkljkjl ^ J^jSZfcLl bkkjk 



Note that the sums are not performed modulo 2. 
We may rewrite the first factor as n™(=i(i""'"")^''' o'" 

nfc<i((-l)-"°-")'""' ■ as B,n is symmetric. The 

second factor of this expression may be joined with the 
second factor of pj to find 



•Ajk\bk 



(4) 



This can be interpreted as follows: 

• If bkk = 1, perform Phasefc(— i). 

• If bki = 1 for fc < Z, perform CPhasefe_i,;(— 1). 

The experimental resources (together with the Hadamard 
gate) are therefore precisely the same as for the prepara- 
tion of graph states. More precisely, the number of gates 
is directly related to the number of non-zero entries in 
B. 

We go on to discuss the doubling scheme from to to 
2to qubits explicitly. We start with a single qubit and 
Bi = (1). To go from to qubits to 2to qubits, we use the 
block-matrix mapping 



Bm ^ B2m — 



(5) 



For example, for one to four qubits, the mapping reads 



(1) 



1 1 
1 



10 1 
10 
\0 1 0/ 



etc. 



(6) 



To check that these matrices Bm fulfill the criteria for 
generating mutually unbiased bases [l9j is in general non- 
trivial, but is in our case for to G {1, 2, 4, 8, ... , 256} 
guaranteed by previous results f20l in connection with 
the work of Wiedemann 
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(3) 



Note that the number of non-zero entries scales linearly 
in TO. The only diagonal non-zero element is bn for any 
number to, so there is just a single Phase gate, and eq. Q 
implies that the value of with j* = (ji , . . . , jmY is real, 
if ji = and purely imaginary otherwise. The number 
of CPhase gates, which is the number of upper diagonal 
elements, increases by to, if we go from to to 2to qubits. 
Altogether we have a single Phase gate and m — 1 CPhase 
gates for a system composed of to qubits, i. e. linear 
scaling with the number of qubits. 

By now, we have constructed a matrix which cycli- 
cally switches between 2"^ + 1 mutually unbiased bases 
in two ways: first, by using the explicit doubling scheme 
for a unitary phase matrix Pm and second, by invok- 
ing a matrix Bm for a decomposition into elementary 
gates. Although not directly relevant to experiments, 
the matrix Vm = H'^™'Pm still lacks normalization and 
a global phase e"''™ to give the generating matrix Um, 
such that Um """^ = 1. It is necessary that the 2™ 



3 



eigenvalues of Um are (2™ + l)-tli roots of unity. Us- 
ing a conjecture, which was numerically checked, that 
Um and therefore Vm arc non-degenerate [l9l |. we may 
choose A = 1 not to be an eigenvalue of Um- As the 
characteristic polynomial of Um is then given by x('^) = 
det(Al2™ - Um) = (A2"+i - 1)/(A - 1) = Efc=o^'' 
see that we have to divide our matrix Vm by — tr Vm to 
get Um.- This trace is given by 1 4- i for to = 1 and 12™/^ 
for TO € {2, 4, 8, ... , 256}, which we derive later in this 
letter. 

For a singlc-qubit register wc take the solution that 
we find with the help of matrix Bi = (1), i.e. Vi = 
H ■ diag(l, — i), where diag(. . .) maps values from a d di- 
mensional row vector to the diagonal of a dx d matrix. By 
dividing Vi by — tr = — (1+i) we receive the matrix Ui 
that switches between three mutually unbiased bases of 
a single qubit. To get an operator that switches between 
five mutually unbiased bases for a two-qubit register, we 
introduce a chop-map Ai that behaves in the following 
way: For V being an arbitrary dxd matrix, v = M{V) is 
a d^-dimcnsional row vector, where the first row of V is 
mapped to -ui, . . . , w^, the second row of V is mapped to 
fd+i, . ■ . , V2d etc. If we use this vector as a phase vector 
such as V2 = H®"^ ■ 6i&g{M.[Vi)) and apply normalization 
and the associated global phase, i.e. U2 = V2/(— trV2), 
we obtain the desired operator for a two-qubit register. 
As stated before, this construction works until a regis- 
ter length of 256, and it holds for an arbitrary number 
of register length doublings, if and only if Wiedemann's 
conjecture is correct. 

In the following we will show how to transfer the dou- 
bling scheme of Bm as in eq. (O to the doubling scheme 
of Vm and Um- We need a particular ordering of the en- 
tries of the basis vectors in Um- We label each vector 
with an m-bit string i = (zi, . . . , imY of zeros and ones 
and sort them in binary increasing order. For the non- 
normalized Hadamard matrix this results in Sylvester's 
construction Hm G M2m(C) for to G Nq. For to = 0, we 
have Hq := (1) and recursively define 



H„ 



H„ 



Hm 



2'" + i \ 



(7) 



we see that H = Hi is the well-known regular Hadamard 
matrix in the qubit case. It is obvious that the entries 
in every Hm are either +1 or —1 and further, Hm can 
be seen as the explicit construction of the m-fold tensor 
product ff^™. 

We can now relate the chop-map doubling scheme for 
Pm to the doubling scheme for Bm of eq. ([5]). We want to 
construct the explicit phases p'^, of P2m to the phases py 
of Pm - As the length of is twice the length of j*, we may 
write j* = (ji, j2)*. In our case of Bm, the exponent of the 
second factor of pj as in eq. ([3]) depends only on 611 and 
remains unchanged by the doubling. The exponent of the 
first factor can be separated into two parts, one arising 



from the old Bm and another arising from the doubling. 
By invoking eq. ([3]) this directly results in the exponent 
being ji ■ BmSi + 2ji • j2 . The first part is exactly the 
phase system of the old matrix Pm, while working out the 
second part results in a factor (— J^, which represents 
the old non-normalized Hadamard matrix, where ji and 
j2 indicate rows and columns, respectively. We conclude 
that the calculation of the phases of V2m can be done by 
applying the local phases of Vm to a Hadamard matrix of 
the right size and then concatenating the resulting rows 
one after the other. 

Before concluding this letter, we shall provide the 
reader with an explicit form of the matrix Um, which 
generates the complete set of mutually unbiased bases; 
to this end, we derive the form of Vm and then cal- 
culate its trace, so that Um = — V^i/tr^n. As seen 
above, we may write the matrices Vm recursively as 
V2m = H^^'^diag{M{Vm)) with Vi = (17) =H{1 1'.). 
Since the entries of H are given by (— 1)' J, we can write 
Vi as: 



(^1). 



1 • i-lf', if j = mod 2, 
-i • i-lf', if j = 1 mod 2, 



(8) 



with r representing the rows and j*the columns of Vi and 
the indices starting with zero. In the Vi case, i* and j* 
arc one bit long, respectively. In the V2 case they are 
two bits long, for the V4 case four bit and so forth, so 
we write the vector as a bit string with the lowest bit on 
the left like 1*= (ii, . . . , imY- To calculate V2, we have 
to chop-map Vi to a diagonal matrix and multiply this 
to H'^^. Thus we get for V2-- 



1 • (-ifj-- (-lp■l■J^ ifi = mod 2, 



-i- (-l)'J • ifi = l mod 2. 

By iteration, this results in the expression 

V-^: "1'' (») 

I— — 1)^, if J = 1 mod 2, 

with X = (ii, . . . , imY ■ {jl, jmY + {ji, j^Y ■ 
. . . , jmY + h- We shall now derive the 

trace of Vm - To simplify matters we consider the real and 
imaginary part of Vm separately. Since the trace is the 
sum over the diagonal entries, we set 1 = ]\a. eq. ([9]). 

For the real part, ji = holds due to eq. To 
calculate the sum of the real part, we add the terms j* 
for which j^+i = pairwise to those terms j* where 
= 1. The Hamming weight of j* and j* differs by 

one, so (—!)■' ■' + J =0. All subsequent terms of j* 

and j* are equal, since j^and differ only in the right half 
of their bits. The first terms are equal due to the fact, 
that the lowest bits of j* and j* are zero. Thus the real 
part of tr Vm vanishes. For to = 1 the real part equals 
one, since there is only a single term with ji =0. 



4 



The imaginary part of tr Vm is given by the sum over 
every second element of the diagonal, i. e. ji ~ 1 . We 
will split this calculation into two steps. In the first step, 
we take those terms where the left half of is filled by 
ones. One of those terms is given by 



-(-1 



J-J-+(l...l)-(jr 



(10) 



The first summand in the exponent calculates the Ham- 
ming weight of J*, whereas the second summand calculates 
the Hamming weight of the right half of j". Since to is a 
power of two, for those cases with m > I, the first two 
summands give the same result modulo two. All subse- 
quent summands without the last one result in powers of 
two, the last term, 1-1, gives one. For to = 1 we have 
only this last summand, so in all cases of to the sum- 
mands add up to an odd integer, thus these terms give 
one. There are 2™/^ ways for J* to have only ones in the 
left half, so they contribute with 2™/^ to the imaginary 
part of the trace. 

There remain those elements of J for which the left half 
has at least one zero bit, but the lowest bit has to be one 
for the imaginary elements. We can pair them like in 
the real part and the same argument brings their sum to 
zero. Thus the trace of Vm is given by 12™/^, and we find 



Urn = i2-"/2if®'"diag(X(i? 



0m/2 



ildiag(l, -i))) 



for TO G {2, 4, 8, . . . , 256}; in the case to = 1 we have 
Ui = -Fdiag(l,-i)/(l + i). 

To summarize, we have shown in this letter how to 
construct a maximal set of mutually unbiased bases for a 
quantum system composed of qubits by a single unitary 
generator, and we have shown how this operation can be 
decomposed into Hadamard, phase and controlled phase 
gates. The necessary resources to implement our scheme 
may be compared to those for preparing graph states, and 
the number of gates scales only linearly in the number of 
qubits. This scaling is optimal, since the graph must be 
connected. We believe that our approach may be of inter- 
est in the one-way quantum computer by Raufiendorf and 
Briegel |2ll424{ , where one uses a nearest- neighbor Ising- 
type interaction to generate a cluster state and one-qubit 
measurements. In our case, we only need measurements 
in the standard bases, but due to our construction, we 
may need CPhase gates with possibly long distances be- 
tween source and target qubits. It would be useful to 
overcome this limitation by a new construction which 
uses band matrices of limited size, or to use qubit imple- 
mentations which make such long-distance CPhase gates 
possible in an experiment. 

A slight disadvantage of our system is that we restrict 
ourselves to numbers of qubits which are powers of two. 
Further work may continue in finding generators of mutu- 
ally unbiased bases for qubit registers of different length. 
For example, if to = 3, we can choose any of the matrices 





Bm 


Bm 


Bm 




Bm 


Bm 


0™ 




\Bm 


Om 


Om 



Bm with TO = 2^^. A doubling scheme similar to eq. ([5]), 
more precisely 



(11) 



produces mutually unbiased bases at least for to G 
{6, 12, 24}. But investigations to be performed in more 
detail require a more thorough understanding of the 
mathematical principles underlying this construction, 
but this is beyond the scope of this letter. 

The authors acknowledge financial support by CASED 
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